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We introduce a constructive method to calculate the achievable secret key rate for a generic class of 
quantum key distribution protocols, when only a finite number n of signals is given. Our approach 
is applicable to all scenarios in which the quantum state shared by Alice and Bob is known. In 
particular, we consider the six state protocol with symmetric eavesdropping attacks, and show that 
for a small number of signals, i.e. below n ~ 10 4 , the finite key rate differs significantly from the 
asymptotic value for n — > oo. However, for larger n, a good approximation of the asymptotic value 
is found. We also study secret key rates for protocols using higher-dimensional quantum systems. 



PACS numbers: 03.67.Dd 

I. INTRODUCTION 

The possibility of secret key distribution is inherent in 
quantum mechanics. Since the intriguing work of Ben- 
nett and Brassard Q, who were the first to realize this 
potential, much effort has been devoted to turn their 
idea into feasible protocols for quantum key distribution 
(QKD). 

The aim of a quantum key distribution protocol is to 
supply the honest parties Alice and Bob with a common, 
random, and secret bit string. This key is generated by 
Alice sending a number of quantum states to Bob, and 
Bob measuring them randomly in one of a set of bases, 
previously agreed upon by both parties. Equivalently, 
this process can be seen as the distribution of an entan- 
gled state between Alice and Bob, followed by appropri- 
ate measurements on both sides 0, Q • In this paper we 
will use the latter approach, i.e. the entanglement-based 
formulation. During the distribution phase it is unavoid- 
able that the quantum state is disturbed by noise, which 
- in the worst case - has to be attributed to interaction 
of the notorious eavesdropper Eve. 

After measuring the shared quantum state, Alice and 
Bob are left with purely classical data, and employ classi- 
cal algorithms to correct errors and reduce the knowledge 
of Eve. For a given QKD protocol to be unconditionally 
secure, in the end the honest parties must have a per- 
fectly correlated string of bits, about which Eve has no 
knowledge, even though she is given unlimited power (i.e. 
she is only restricted by the laws of physics, but not by 
any minor technological difficulties such as producing a 
loss-less fiber or building a quantum computer). This 
bit string is the secret key, and its length divided by the 
initial number of signals is the secret key rate. This fun- 
damental quantity is, due to the complexity of the various 
quantum and classical steps, very difficult to determine. 

Recently, important progress has been achieved to- 
wards the calculation of secret key rates: unconditional 
security proofs were formulated for generic QKD proto- 
cols (see, for instance, 0J|). In this way, every proto- 
col (e.g. BB84 B92 : [Jthe Ekert protocol [13, the 
six-state protocol 0, Q ) can be fit into a common frame- 
work to analyze the security and derive bounds for the 



secret key rate. However, these bounds only hold for the 
asymptotic case, where infinitely many signals are used. 
For realistic implementations, it is important to address 
the case of a finite number of signals. This is the topic 
of our contribution. 

The outline of this article is as follows: in section [H] 
we give an overview over the structure of QKD protocols 
and explain the starting point [f| of our calculations. In 
section lllll we review the tomographic protocol, before 
we come to the main part, namely the calculation of the 
entropies for the bound on the secret key rate, in sec- 
tion ^3 Our results are presented in section Ivl and we 
conclude in section IVll 



II. GENERAL QUANTUM KEY 
DISTRIBUTION 

In this section we give an overview over the structure of 
common QKD protocols and introduce our notation and 
some recent results [Bj], that will be the starting point of 
our analysis. 

Every QKD protocol can be divided into two parts: a 
quantum part, in which quantum mechanical systems are 
distributed between Alice and Bob and upon which some 
measurements are carried out, yielding classical data. In 
the second part, this data is transformed into a secret 
key by means of classical error correction and privacy 
amplification |6| . We will only consider one-way classical 
post-processing, which will be described in detail below. 



1. Quantum part 

Most well-known QKD protocols like the BB84 , six 
state HOI, B 9 2 0> or the Ekert [13 protocol only differ 
in the type of quantum correlations that get distributed 
between Alice and Bob, and how much information about 
the adversary the honest parties can extract. The quan- 
tum part of the protocol can be summarized by the fol- 
lowing steps: 

(i) Distribution. Alice prepares n' maximally entan- 
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gled states in dimension d, 

ltf):=^Eln), (1) 

and sends the second half of each pair to Bob. 
Due to channel noise and/or Eve's interference, this 
state may get corrupted. Thus, after the distribu- 
tion, Alice and Bob end up with a state p n AB , de- 
scribing all n' pairs, that is in general mixed. 

(ii) Encoding /Measurement. Alice and Bob agree on a 
set of r different encodings ("bases") {|ef)} for the 
qudit state \x), with 1 < i < r and < x < d — 1, 
where (ef |ef) = S xy [22 . For each pair of parti- 
cles, Alice and Bob choose at random an encoding 
j and k and measure their particles with respect to 
that basis. They obtain a classical dit value, where 
the correlation between these ciits depends on the 
choice of the encodings. As an example, in the two- 
dimensional case (d = 2) for the BB84 protocol, we 
have r = 2 different encodings: \ef 2 ), with x = 0,1, 
are the eigenstates of two Pauli operators. 

(hi) Parameter estimation. By comparing a random 
part of the data collected during the measurement 
step, Alice and Bob can get some information about 
the state p AB - Usually, this will be the error rate, 
which can be calculated for all different encodings 
used in the previous step. Depending on this infor- 
mation, Alice and Bob decide whether to continue 
with the protocol or abort, if they cannot ensure 
its security. 

(iv) Sifting. Alice and Bob announce over the classical 
channel which encoding they chose for each qudit 
pair. All their measurement data for which the 
setting matched 23| form the sifted keys X and 
Y for Alice and Bob, respectively, which are not 
necessarily identical yet. We denote by n the length 
of the strings X and Y after the sifting step, i.e. 
the number of states that were measured in the 
same basis by Alice and Bob. This means that n is 
approximately equal to n' divided by the number 
of different encodings used in step (ii). We denote 
by p AB the part of the state p AB which is kept in 
the sifting. 

At this point, Alice and Bob are left with purely classical 
data, namely the <iit strings x and y, whereas Eve might 
still hold a quantum system that was entangled with p n AB . 
We have to consider the worst case, in which Eve holds a 
purifying system of p n AB , i.e. p n AB = tr e \'<Pabe){'<Pabe\, 
where the system in E is under Eve's control. The sit- 
uation where classical data (which is obtained from p AB 
by Alice's and Bob's measurements) is correlated with a 
quantum system can be described by a classical-classical- 
quantum state |12| 

Pxyb = f xy(x, y)P| x) ® P, y) ® p E y . (2) 



Here, Pxy is the probability distribution of Alice's and 
Bob's random variables X and Y and p 1 ^ is the state 
that Eve holds if X = x and Y = y. We use the 
notation that capital letters, e.g. X, represent classi- 
cal random variables, taking values x from an alphabet 
X = {0, 1, . . . , d — 1}. Bold letters denote vectors, e.g. 
x = (xi, x-2, . . . , x n ). We denote by P\ x \ — \x)(x\ the 
projector on the quantum state |x) and by Px the prob- 
ability distribution of the random variable X. 

2. Classical part 

In this part of the key distribution, which is common 
for all well-known QKD protocols (with one-way post- 
processing), the classical strings X and Y will be made 
equal and secure. This is achieved by the following clas- 
sical sub-protocols: 

(v) Pre-processing and error correction. In the pre- 
processing stage Alice computes a new random 
variable U from her data X by the use of the chan- 
nel U <— X, defined by some conditional probabil- 
ity distribution Pu|x- The string U will then serve 
as the key. In the error correction step, Alice sends 
the information that Bob needs to compute U from 
his data Y. This information can be quantified by 
a random variable W. 

(vi) Privacy amplification. Alice and Bob shrink the 
length of the key U and at the same time reduce the 
information that Eve might have about it, thereby 
generating a secret key. Since the privacy ampli- 
fication is an important step, which will be the 
starting point of our calculation, we review this 
sub-protocol in more detail here. We also review 
the security analysis of privacy amplification and 
present an expression for an achievable secret key 
length, as found in fl3| . 

Secret key generation by privacy amplification 

Consider the case in which Alice and Bob hold a com- 
mon random string U, which is supposed to serve as a 
secret key. In the privacy amplification step, the infor- 
mation that Eve might have about the key U is reduced. 
This is done by choosing a two-universal hash function 
F and computing F(\J) as the new key. A two-universal 
hash function is a random function F : U — > {0, l} e 
such that F(u) and F{u') are independent and uni- 
formly distributed for all u ^ u' |13| . Then the infor- 
mation that Eve can have about F(XJ), dependin g on 
the quantum state p B she holds, can be bounded |13|. 
This result can be applied to calculate the secret key 
rate obtainable by Alice and Bob. "Secrecy" is mea- 
sured with respect to the universal composable defini- 
tion of unconditional security [l4|: Let and S B be 
random variables that describe keys that Alice computes 
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from U and Bob computes from his guess about U, us- 
ing the random hashing. This situation, together with 
Eve holding a quantum state containing some informa- 
tion about the keys, can be described by the classical- 
classical-quantum state Ps a SbE- The case of a perfect 
key, i.e. Sa = Sb = S, where S is uniformly dis- 
tributed over the set of all possible keys S and Eve 
being completely uncorrelated with S is described by 
Pss ® Pe ■■= Y, s es P \s) ® P\s) ® Pe- The key pair 
Sa, &b is said to be e-secure, if \\ps A s B E — Ps® Pe\\ < £■ 
Here, ||p - <r|| = tr|p - cr|/2, with \A\ = VA^A, denotes 
the trace distance between p and a. It provides a mea- 
sure of how close the actual system is to the ideal case 
and how "secure" the final key will be. 

An important result which will be used here was found 
in (see also 0): Suppose Alice and Bob both share 
the same random string U, which they compute from 
their raw data strings X and Y via pre-processing and 
error correction. The adversary holds some quantum sys- 
tem pe that might be correlated with U, i.e, the total 
system can be represented by some density operator pue- 
Then an achievable length t of the secret key that can be 
computed from U by a two-universal hash function F is 
given by [l3|: 

I = Si' ( PVE ) - Stf(p E ) - 21og a (l/e), (3) 

with e' — (e/8) 2 , if the key is required to be e-secure 
with respect to p E <8> P\f)- Here, the state pe <$ P\f) 
describes the total knowledge of Eve, since she also learns 
the function F on which Alice and Bob have to agree by 
public communication. The quantities Sf an( i &o that 
occur in Eq. are called smooth Renyi entropies and 
are defined as follows. 

Denote by B s (p) the set of density matrices that are 
e-close to p, i.e. B £ (p) := {a G S(H) : \\p — a\\ < e}, 
where S(Ti) is the set of density matrices acting on the 
Hilbert space H. 

Definition 1. Let p G S(H) and e > 0. The e-smooth 
Renyi entropies of order 2 and are defined as 

Sl(p) = -log a inf tra 2 , (4) 
Sq(p) = log 2 mf ranker. (5) 

In the following, we will also need a classical Renyi 
entropy, which is defined as follows: 

Definition 2. Let X and Y be random variables, tak- 
ing values x G X and y G y , respectively, and let Pxy 
be their probability distribution. Then the conditional 
smooth Renyi entropy of order zero is defined as JTjfy 

ffi(X\Y):= min 

A:P(A)>l-e 

( maxlog 2 \{xeX : P X a\y= v (x) > 0}| ] . (6) 



Here, the minimum is taken over all events A that 
occur with probability at least 1 — e. Smooth Renyi en- 
tropies are generalizations of the conventional Renyi en- 
tropies 0] : The classical Renyi entropy of a probability 
distribution Px is a measure of the largest (in the case 
of S2) or smallest (in the case of So) uncertainty about 
X that can be found within all probability distributions 
that are close 24] to Px- In the quantum case, this 
translates to the entropy of density operators that have 
a trace distance to p that is less or equal to e. 

If we want to apply Eq. © to our QKD protocol, we 
need to specify the overall quantum state representing 
Alice's and Bob's classical strings and the information 
that Eve holds, which might be at least partly of quan- 
tum nature: It consists of a density operator p^ that 
depends on the strings x and y that Alice and Bob have 
measured, together with the classical information that is 
interchanged via the public channel, i.e. the error correc- 
tion information w. After the error correction, Alice and 
Bob both hold the same string u. Thus, the situation 
can be described by the following quantum state: 

PUWE = J! P XYUw(x, y, U, W)P| U ) ® (P| w ) <g> pg). 
x,y ,u,w 

(7) 

If we now use Eq. © to calculate the key length, we still 
have the dependence on the error correction information 
W. In 5] it was shown that it can be removed, leading 
to another additive term Hq (U|Y), which is the informa- 
tion needed to correctly guess U from Y with probability 
of at least 1 — e. The quantity Hq is called (classical) con- 
ditional smooth Renyi entropy, and was defined above. 
We will restrict ourselves to the simple case where Al- 
ice skips the pre-processing step (first part of step (v) in 
our generic protocol, cf. section [HJ, i.e. U = X. This 
leads to the following formula for an achievable length of 
the e-secure key, which will be the starting point of our 
calculations: 

t = S s 2 '( P xe) - S^pe) - H^'(X\Y) -2106,(1/6), (8) 
with ef = (e/8) 2 . 

III. THE TOMOGRAPHIC PROTOCOL 

Although equation (JSJ is an explicit formula for an 
achievable key length for any QKD protocol that fits into 
the framework described in section [HI the main problem 
is the ignorance about Eve's state pe- If this state is not 
known, the entropies in Eq. JSJl cannot be calculated. 
However, the data gathered in the parameter estimation 
step (iii) poses some restrictions on Eve's state. For ex- 
ample, in the BB84 protocol, starting from \4> + ) as de- 
fined in m with d — 2, a measured bit error rate et> 
implies a fraction e& of and of the 

n qubits shared by Alice and Bob (here Icj)^} and 
are the usual Bell states). Thus it is possible to deduce 
part of the structure of Eve's purification. Exploiting 
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this knowledge, one can obtain a lower bound on Eq. (JSJ 
by taking the infimum over all states of Eve that are 
compatible with the statistics obtained in the parame- 
ter estimation step. Having this in mind, we make the 
following assumptions for our finite key analysis: 

1. Collective attack. The state that Alice and Bob 
share after the distribution step is given by 

P n AB=PT B , (9) 

i.e. Eve interacts only with individual signals and 
does so in the same way for all copies. Note that 
this is not really a restriction, since in [5| it was 
shown that Alice and Bob can always symmetrize 
the state p n AB to a tensor product form by only 
slightly modifying the protocol. 

2. Symmetric attack. Each single state is a depolar- 
ized version of the maximally entangled state l|T[l. 
i.e. 

PAB = (Po-l3iM)((i>i\ + tjl- (10) 

We have adopted here the notation of 0] ■ The two pa- 
rameters Po and /3i are not independent, and the nor- 
malization condition reads flo -\- {d — V)f3\ = 1. One 
can interpret f3o as the probability that Alice and Bob 
get the same output, and f3\ as the probability that 
they get a particular other one, so we always assume 
< Pi < 1/d < flo < 1- In the limit n — > oo, the error 
rate in the sifted key (for d = 2, this is called the quantum 
bit error rate, QBER) is given by 1 — /3o = (d — l)/3i- 

We make no further restrictions on the eavesdrop- 
ping strategy besides being collective and symmetric, and 
therefore assume that Eve holds the purifying system of 
each state pab ■ It is important to note that by fixing the 
form of the distributed state p AB (as in Eq. @ and ^UJl), 
which is the "output" of the whole quantum part of the 
protocol (cf. section|nj), the encoding step (ii) essentially 
becomes meaningless. This is because we now have the 
freedom to choose any kind of encoding, since in the end 
we are assuming p n AB = p AB with pab given by (jTU|l any- 
way. However, as Eve knows Alice's and Bob's protocol, 
she would not necessarily conduct such a symmetric at- 
tack if Alice and Bob could not check for the state pab 
to be of the form l|10() . Therefore, we assume that Alice 
and Bob use a scheme that enables them to do so, which 
is achieved by encoding the basis states {\x)} into d + 1 
mutually unbiased bases, which corresponds to a gener- 
alization of the six-state protocol to d dimensions (where 
d is a prime power). Such a "tomographic" protocol was 
originally suggested in [17], [l8( , in the context of a con- 
nection between advantage distillation and entanglement 
distillation. In the parameter estimation step (iii), the 
only unknown parameter (3 Q (or j3\) in Eq. (|10|l can be 
estimated by comparing a randomly chosen subset of the 
raw key. 



IV. METHOD FOR CALCULATING SMOOTH 
RENYI ENTROPIES 

In this section, we derive a method for calculating an 
achievable secret key length for our generic protocol in- 
troduced in the previous section. This method is appli- 
cable in all scenarios, in which the state p AB is known. 
Explicitly, we will study as an example the state for a 
symmetric attack, as defined via Eqns. 10 and (JTUJ) . For 
a given state p\ B (and its purification), the difficulty in 
computing the key length (jSJ is due to the minimization 
over the e-environment B £ (p) involved in the (quantum) 
smooth Renyi entropies. This is because very little is 
known about the structure of the set of density matri- 
ces that are close to a given one. Even for states with 
a tensor structure, as for p AB in our case, the analysis 
is still very involved, since B £ (p® n ) of course not only 
contains product states. Fortunately, since we are only 
interested in minimizing a function of the eigenvalues of 
density matrices, it turns out that we can restrict our 
attention to matrices which have the same eigenvectors 
as p. This intuition is formalized in Lcmma[I] 

Let us denote by X(p) the ordered spectrum of p, i.e. 
X(p) = (Ai, . . . , Xd) € R d in ascending order, with d = 
dim(ft). Also denote by ||A - A'|| = 1/2 £\ |Aj - A<| the 
distance of the vectors A and A'. Recall that B € (p) is the 
set of density matrices which are e-close to p. We define 
V £ (p) = {a S S(H) : [a, p] = 0, || X(a) - X(p)\\ < e} to be 
the set of density matrices which commute with p (i.e. 
they have the same eigenvectors) and have a spectrum 
e-close to that of p. 

Lemma 1. The two sets A^(p) = {A(er) : a € B £ (p)}, 
and A|,(p) = {X(a) : a 6 T> £ (p)}, defined as the sets 
of spectra that correspond to the sets of density matrices 
B E (p) andT> £ (p), respectively, are identical. 

Proof. Since for two commuting matrices p and a, we 
have that \\p — a\\ = \\\{p) — A(cr)||, it follows im- 
mediately that T> £ {p) C B e {p) which in turn implies 
A^(jO) C A £ B (p). The other inclusion follows from the 
fact O that \\p-o-\\ > \\X(p) - X(a)\\. □ 

From this lemma, it follows immediately that all func- 
tions than only depend on the eigenvalues of a density 
matrix and which are to be minimized over the set B e (p) 
can equivalently be minimized over T> £ (p). In particu- 
lar, this holds for the smooth Renyi entropies defined in 
Def. □ 

Our goal is to calculate the achievable key rate in the 
case where Alice and Bob hold an n-fold tensor product 
of the state pab, as defined by Eq. (|10(l . It was shown 
in 0| that a purification of the state (|10|l is given by 

k=0 k=£l 

where Eve's states {E^} are constrained by (E^Eu) = 
1 — fli/flo for k I and \Eki) is orthogonal to all other 
states for k I. 
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To calculate the key length (JSJ, we need to know the pe, and therefore an index of A runs from to n, although 



states pxb = l/rf™Ex,y- p XY(x,y)i^ x ) <& p E y and p E = 
trxpxB- Bob's random variable Y does not appear here 
explicitly, since it is equal to that of Alice after the error 
correction. From Eq. we can readily compute p E y , 
which is the state that Eve holds if Alice and Bob got 
the string x and y as their measurement results, as well 
as the probabilities Pxy (x, y) . We find 



PE 



x \ » 

\ y? 

\ X x,y 

n 

^x Y (x,y) = J] [ft + S Xim (/3 - ft)] 



(12) 
(13) 

(14) 



Due to the properties of the states \E xy ), it follows that 
Eve's state pe has rank d 2n if 0q ^ 1, and rankpx_B = 
d 3n if /3 ^ 1. 

In the following three subsections, we analytically com- 
pute the entropies that appear in Eq. It turns out 
that they are given by simple functions of the eigenvalues 
of the corresponding density matrices. Unfortunately, 
they cannot be expressed in a closed form, so in the end 
we have to resort to numerics in order to obtain numbers. 
However, all numerical calculations stay exact without 
any approximations, and can be performed in a very ef- 
ficient way. We explain the calculations of the entropies 
in some detail, since we believe that our method is inter- 
esting and useful on its own, as it can be used whenever 
one wants to determine the extremum for a function of 
the spectrum of a state, in the neighborhood of a given 
density matrix. 



A. Calculation of Sq(pe) 

To calculate Sq(pe), we need the eigenvalues of the 
state pe & S((<C d ) 2n ). It turns out that p E , as defined 
in Eq. (|13|1 . has the following eigenvalues A; and corre- 
sponding multiplicities ni, for < I < n, where n is the 
number of signals after the sifting: 



A; := [po-0i + 



#,(<* + !) -lV ( N " ' 



\d(d- 1) 



nt 



(d 2 - 1) 



n—l 



(15) 
(16) 
(17) 



Note that the A/ are given in ascending order. We will use 
the convention that A/ denotes all different eigenvalues of 



there are d 2n eigenvalues in total, which we will denote 
by A', such that {A/}o</<« = {X[>} i<i> <d 2 ™ ■ 

Now and in the following we use Lemma ^ which 
allows us to calculate the infimum in Sq(pe) — 
log 2 infg-ggE^) ranker by only varying the eigenvalues of 
Pe- Thus we are looking for a density matrix a with 
eigenvalues {pf\ which is diagonal in the same basis as 
Pe and has rank as small as possible under the con- 
straints J^i \K ~ Mil ^ 2e. Clearly, such a matrix is 
given by a = diag (0, . . . , 0, X' k+V A^ 2n _ 1 , A^ 2 „ + 5), 

where 53j=i K =: ^ — e with k chosen maximally. In 
this way we have found ranker = rankp^ — k. It remains 
to determine fc, which can be done efficiently because of 
the degeneracy of the eigenvalues. Below we construct an 
algorithm that computes k in 0(n) running time, rather 
than scaling with the total number of eigenvalues 0(d n ). 
In order to calculate fc, define 



s r := yVt-iA-j-i, 



(18) 



»=i 



for < r < n + 1, which is the sum of the r smallest 
different eigenvalues. (For r — 0, the sum is taken to be 
zero.) Moreover, let 



b := max{r : s r < e} 



(19) 



be the the largest number such that the sum of the b 
smallest different eigenvalues is smaller than e. A mo- 
ment of thinking then reveals that k is given by 



b 

i=l 



•Si, 



A,, 



(20) 



where [^J denotes the largest integer smaller than or 
equal to x. This leads to 

Sl{ PE )=\og 2 {d 2n 



k). 



B. Calculation of S|(pxe) 



(21) 



The calculation of S^Pxe) is similar to the calcula- 
tion of Sq(p e ). We first need the eigenvalues of pxe € 
S({€ d ) 3n ), defined in Eq. (JEJ, and their multiplicities. 
This matrix has d 2n non-zero eigenvalues in total: 

I / n \ n — l 



l+l 



d" 
d" 



Pi 



d 

(d- 



- 1 



for < I < n. Moreover, px_E has d 3 " 
values, independently of /3q and ft: 



An 
n 





d 3n 



-fin 



(22) 

(23) 

(24) 
zero eigen- 

(25) 
(26) 



6 




FIG. 1: Visualization of the definition of x, y, and s*, to- 
gether with the eigenvalues A; and multiplicities n; as defined 
in section liV Bl In this example, we have b~ = 1 and b + — 3. 



Altogether, we have < I < m, with m := n+l, denoting 
all different eigenvalues. 

Recall that Sf (p) = — log 2 inf CTe BE( p ) trcr 2 , thus we are 
looking for a density matrix a with ordered eigenvalues 
that minimizes J2i "I under the constraints J2i M« — 
1 and J2i \ ~ Mil = 2e. Using the Lagrange multiplier 
method it can be shown that the solution is 

{a; for < i < b~ 

Xi for b~ < i < n - b + , (27) 
y for n — b + < i < m 

with some constants x, y, b~ , b + which have to be deter- 
mined. This means that the smallest 6~ + 1 eigenvalues 
A get raised to x, the largest b + + 1 get lowered to y, and 
the intermediate ones stay unchanged. Since the mean 
J2 i fii/d 3n has to remain l/d 3n , we find y and x by cut- 
ting the largest (smallest) eigenvalues such that the sum 
of differences between the largest (smallest) ones and y 
(x) equals e (see also Fig. P). 

In the following, we give an efficient algorithm for cal- 
culating the constants x, y, b~ , and 6 + , which is very sim- 
ilar to the one calculating Sq(pe) in the previous section. 
Let 

r 

tS r~ := n m-i+l(^m-i+l ~Kn-r), (28) 

r 

s- := ^n^iCAr-Ai-i), (29) 
i=i 

for 0<r<m = n+l. Then the number of the largest 
(smallest) different eigenvalues, that can be lowered to y 
(raised to x) is given by 

b ± := max{r : sf < e}. (30) 



With these definitions we find that 

x = X b -+^^, (31) 

V = A m _ 6+ - — p . (32) 

Z^i=0 n m-i 

Having calculated the eigenvalues /ij, the entropy is fi- 
nally given by 

i=0 i=b-+l 

m \ 

Y^y 2 • (33) 

i=b+ / 

C. Calculation of #<f(X|Y) 

Recall the definition of the conditional e-smooth Renyi 
entropy of order zero, 

tf E (X|Y) := mm (maxlog 2 \V Ay \) , (34) 

A:P(A)>l-£ \ y / 

where we have introduced T&y : = { x : -PxA|Y=y( x ) > 
0}. First note that Hq(X.\Y) depends only on the num- 
ber of elements in the set VAy, i-e. on the number of 
non-zero entries in the probability distribution -PxA|Y=y 
Since in our case all values of Px|Y=y are non-zero for all 
y (except for the case of perfect correlations, i.e. (3q = 1), 
the maximization over y can be omitted. Thus the only 
restriction on the number of non-zero probabilities comes 
from A. The minimization over all these events occurring 
with probability larger or equal to 1 — e can be tackled in 
the following way: All relevant events A need to be of the 
form [X = x 1 ]V---V[X = x fc ],with^ti p x(x 4 ) > 1-e. 
Since we are looking for the smallest set V^y (y being 
arbitrary), we are interested in those events which are 
most restrictive, i.e. which have k as small as possible. 
This means we need to find the smallest number k such 
that the sum of the k largest probabilities in -Px|Y=y is 
greater or equal to 1 — e. To this end we look at the 
probability distribution (|14fl and find the following prob- 
abilities pi and occurrences rii, when we condition on a 
certain value y: 

Vi := (3 l ^~ l (35) 
ni := (f\(d-l) n - 1 (36) 

In analogy to the calculation of Sq(pe), define 

r 

S r ■= y"^n-i+iP»-i+i, (37) 

i=l 

with < r < n+l, to be the sum of the r largest different 
probabilities pi. Then the smallest number b such that 
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FIG. 2: Key rate versus signal number n for three different 
values of the security parameter (from top to bottom: e = 
0.5, 0.2, 0.01) for a fixed error rate in the sifted key 1 — j3o = 
0.02. The dashed line is a lower bound of the asymptotic 
value lim e ^o lim n ^oo tjn = 0.758059 found in fe- 



ttle sum of the largest b different probabilities is greater 
or equal than 1 — e is given by 



b := min{r : s r > 1 — e}. 
With these definitions we find 

b 



s b - (1 - e) 



Pn-b+l 



(38) 



(39) 



(40) 



Finally, we arrive at 

i^(X|Y)=log 2 fc 

V. RESULTS 



In the previous section, we calculated the entropies 
involved in the formula for the achievable key length 10 • 
Each entropy is given as a simple function that can be 
evaluated numerically in a very efficient way with only 
0(n) running time. Note that all results are exact (up to 
machine precision), since no approximations are needed 
at all. Still, the parameter n (the number of signals) is 
crucial in the implementation and we arc limited to values 
of the order 10 in this quantity. However, this is not a 
conceptual limitation: using more powerful computers, 
it is feasible to push this limit further, but we do not 
believe that this approach would yield surprising results, 
in view of the results presented in this section. 

The scenario that we are investigating is described by 
the following parameters: The number n of (quantum) 
signals sent from Alice to Bob which are kept during the 
sifting step, the error rate in the sifted key 1 — Po (see 
Eq. (|10f> ). the security parameter e, and the dimensional- 
ity d of the quantum systems sent from Alice to Bob. For 
better accessibility, we plot the secret key rate r, which 
is defined as r — t/n, rather than the key length £. 



Figure [3 shows a plot of the obtainable key rate r, as a 
function of the number n of signals that were measured 
in the same basis by Alice and Bob. In this example 
we keep the error rate fixed at 1 — /3q = 0.02 and show 
plots for different security parameters e. The error rate 
is chosen such that we are looking at the regime where 
the key rate is large and where a simple pre-processing 
does not seem to play any role |5(. For comparison, we 
also plot a lower bound on the secret key which holds 
for any eavesdropping attack, but is only exact in the 
limiting case n — > oo; this result was recently derived by 
Renner et. al |5j. Our key rates approach the asymptotic 
value r — 0.758059 as n grows. From the plot, we recover 
the result found in [I| that in the limit n — > oo, the de- 
pendence on the security parameter e becomes negligible, 
as the three curves for different e approach each other. 
Note that for a small number of signals the secret key 
rate shows a considerable deviation from the asymptotic 
value. For a value of n = 10 4 , however, the key rate 
for even a small e — 0.01 reaches already over 83% of 
the asymptotic value. To give a comparison with exper- 
imental implementations, e.g. the number of signals n 
(after sifting, but before classical post-processing) in the 
experiment described in |20( is of the order of 10 5 . 

A prominent feature of our results are the "oscilla- 
tions" of the achievable key rate, the amplitude of which 
decreases as n increases. Analytically, the oscillations 
arise from the structure of £ given in Eq. JSJ), being the 
difference of the three monotonic functions Sf , Sq , and 
Hq where the last two are smoothened versions (see 
Fig.[3J of a non-continuous function. In the limit n — > oo, 
the non-continuities disappear, leading to a monotonic 
key rate. Up to now, we can give no physical explana- 
tion for the non-monotonicity, besides the fact that our 
formula is just an achievable key rate and thus only a 
lower bound on the optimal key rate. Moreover, we dis- 
regarded the classical pre-processing step in our analysis, 
and thus the key rate might also increase in some cases. 
Note that up to now, no one-way pre-processing protocols 
except for the addition of noise [5| have been studied. It 
was found that the addition of noise has no effect on the 
key rate if the correlations between Alice and Bob are al- 
most perfect (as in Fig.[2J), but the rate can be increased 
in the region where 0.88 < /3 < 0.92. 

The dependence of the secret key rate on the error rate 
1 — (3o is visualized in Fig. 0] The secret key rate is only 
non-negative for error rates smaller than sa 0.11 and gets 
larger as the error rates 1 — /3o is decreased. The key rate 
for finite n is always smaller than the asymptotic value 
(unless 1 — (3q — 0), and it increases as e increases, i.e. 
as the required security decreases. 

Since our formulas are valid not only for qubits, but 
also for higher-dimensional systems, we can study the in- 
fluence of the dimensionality on the obtainable key rate. 
To be able to compare the efficiency of encoding the in- 
formation in d = 2,3,4 dimensions, we introduce the 
quantity n := n' d = n(d + l)d which quantifies the total 
resources needed in the protocol: We have already men- 
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FIG. 3: Plot of the three entropies in Eq. (JHJ constituting the 
secret key length i up to an additive term 21og 2 (l/e). In this 
example we have 1 — /3q = 0.02 and e = 0.5. 

tioned that the number of signals before (n!) and after 
the sifting (n) are related by n = n' / (d + 1), where d + 1 
is the number of different encodings used (we consider 
the "tomographic protocol"). The factor d accounts for 
the dimension of the single quantum system. We com- 
pute the "effective key rate " £/h, i.e. the key length, 
measured in bits, divided by the "total dimensionality" 
of the Hilbert space of all signals of the raw key (be- 
fore the sifting). In this way we have quantified the rate 
with respect to the number of initial resources needed to 
create the key. Recall that 1 — fto = (d — l)/3i is the 
error rate (in the limit n — > oo) in the sifted key, which 
is called quantum bit error rate (QBER) in the case of 
dimension d = 2. This quantity gives the fraction of er- 
rors per (fit in the sifted key, which makes it difficult to 
compare different dimensions, unless one can make rea- 
sonable statements about how the error rate 1 — fto scales 
with d, i.e. how the eavesdropper treats different dimen- 
sions. Keeping this problem in mind, we see in Fig. [5] 
the dependence of the effective key rate £/h on the error 
rate 1 — /3q, for a fixed n = 20000 and security parameter 
e = 0.1. We can read off the maximal tolerable error rate 
for which a secret key can still be extracted and fortify 
the result found in |21| , namely that the robustness of a 
QKD protocol increases as the dimension d of the quan- 
tum systems increases. This result also holds if sifting is 
disregarded, i.e. if we keep dn fixed and look at £/(dn). 
On the other hand, if Alice and Bob are highly correlated 
(/3o — * 1), we find the reverse dependence on the dimen- 
sion: A qubit system yields the highest effective key rate 
and this rate decreases as the dimension d increases. 



VI. CONCLUSIONS 

We have developed a method for the explicit calcula- 
tion of the secret key rate in quantum key distribution 




0.02 0.04 0.06 0.08 0.1 0.12 



1-Po 

FIG. 4: Key rate r plotted versus the error rate in the sifted 
key, 1 — /So, for a fixed number of signals n = 20,000. The 
three solid lines correspond to different security parameters 
(from top to bottom: e = 0.5,0.2,0.01). The dashed line is 
again the asymptotic value lim e ^o lim n ^oo l/n. 

with a finite number of signals n, under the assumption 
that the eavesdropper only conducts symmetric collec- 
tive attacks, i.e. the state shared by Alice and Bob after 
the quantum part of the protocol (cf. section [H} has the 
hvmp% = [(/3b-fr)|#><#|+/3il/tfl 8B . At this step, 
Alice and Bob have to measure this state in the compu- 
tational basis to obtain the classical bit strings that are 
the starting point of the classical post-processing. This 
means that any protocol in which Alice and Bob can 
ensure that they share such a state and which uses pri- 
vacy amplification is covered by our analysis. In reality, 
obtaining knowledge about p®^ is a hard task, but we 
believe that our analysis of the idealized case helps in 
solving the challenge of a finite key analysis of a more 
general scenario. 

We have shown that the secret key rate obtainable by 
our protocol strongly depends on the number of quantum 
signals sent. Our results suggest that for signal numbers 
larger than n ~ 10 4 , the asymptotic value for the key 
rate found by is a good approximation. However, for 
smaller values of n, we find a significantly lower value. 
This is remarkable in particular because we restricted our 
analysis to a symmetric eavesdropping strategy, thereby 
weakening Eve's power and potentially increasing the ob- 
tainable key rate. In contrast, the result found in [5| cov- 
ers all eavesdropping attacks and thus the asymptotic 
value of r is already based on pessimistic assumptions. 
Therefore, our results suggest that for scenarios with only 
a few number of signals, significant deviations of the key 
rate from the asymptotic value are to be expected. 

A popular task in the analysis of quantum key distribu- 
tion is the characterization of the threshold QBER, which 
is the maximal quantum bit error rate, for which the pro- 
tocol still yields a non- vanishing key rate. However, even 
a high threshold QBER does not guarantee a feasible pro- 
tocol, as the key rate might be arbitrarily close to zero or 
increase very slowly with decreasing QBER. Our results 
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on the other hand quantitatively characterize the secret 
key rate with respect to all parameters of the protocol. 
In particular, we have shown that for d-dimensional gen- 
eralizations of the six-state protocol, larger dimensions 
give a higher robustness, i.e. more noise is tolerable, but 
smaller dimensions yield a higher key rate if the the cor- 
relations between Alice and Bob are already high. 
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